Fixed access control check when managing all device groups.
Ylian Saint-Hilaire committed
Jul 14, 2020 at 12:10 UTC
2f6c2edbf2604a944726d7a7a9e8e7e855d42599
2 files changed
+4
-4
views/default-mobile.handlebars
+2
-2
@@ -4105,7 +4105,7 @@
4105
if ((mesh == null) || (mesh.links == null)) { return 0; }
4106
4107
// Check if super user
4108
- if (userinfo.manageAllDeviceGroups) return 0xFFFFFFFF;
4108
+ if (userinfo.manageAllDeviceGroups && (userid == userinfo._id)) return 0xFFFFFFFF;
4109
4110
// Check device group link permission
4111
var rights = 0, r = mesh.links[userid];
@@ -4141,7 +4141,7 @@
4141
if (mesh.links[userid] != null) { return true; } // User has visilibity thru a direct link
4142
4143
// Check if user user
4144
- if (userinfo.manageAllDeviceGroups) return true;
4144
+ if (userinfo.manageAllDeviceGroups && (userid == userinfo._id)) return true;
4145
4146
// Check permissions thru user groups
4147
var user = null;
views/default.handlebars
+2
-2
@@ -12831,7 +12831,7 @@
12831
if ((mesh == null) || (mesh.links == null)) { return 0; }
12832
12833
// Check if super user
12834
- if (serverinfo.manageAllDeviceGroups) return 0xFFFFFFFF;
12834
+ if (serverinfo.manageAllDeviceGroups && (userid == userinfo._id)) return 0xFFFFFFFF;
12835
12836
// Check device group link permission
12837
var rights = 0, r = mesh.links[userid];
@@ -12867,7 +12867,7 @@
12867
if (mesh.links[userid] != null) { return true; } // User has visilibity thru a direct link
12868
12869
// Check if user user
12870
- if (serverinfo.manageAllDeviceGroups) return true;
12870
+ if (serverinfo.manageAllDeviceGroups && (userid == userinfo._id)) return true;
12871
12872
// Check permissions thru user groups
12873
var user = null;